Vulnerabilities CVE-2026-14848

CVE-2026-14848

None

Open

TLP:CLEAR

Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.

Details

EPSS Score ⓘ: 0.17%

6.6th percentile
Confidence: 90%
Published: Aug 4, 2026
Last Modified: Aug 4, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.